CVE-2009-2064
Last modified
CVE-2009-2064 is a vulnerability of currently unknown severity. Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages.". EPSS estimates a 4.27% chance of exploitation in the next 30 days.
Description
Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Internet Explorer | <= 8 | Beta2 |
| Microsoft | Internet Explorer | 5 | — |
| Microsoft | Internet Explorer | 5.01 | Sp4 |
| Microsoft | Internet Explorer | 6 | — |
| Microsoft | Internet Explorer | 7 | — |
| Microsoft | Internet Explorer | 7.0.5730 | — |
| Microsoft | Internet Explorer | 8 | — |
| Microsoft | Internet Explorer | 8.0b | — |
| Microsoft | Pocket Ie | 1.0 | — |
| Microsoft | Pocket Ie | 1.1 | — |
| Microsoft | Pocket Ie | 2.0 | — |
| Microsoft | Pocket Ie | 3.0 | — |
| Microsoft | Pocket Ie | 4.0 | — |
| Microsoft | Pocket Ie | 2002 | — |
| Microsoft | Pocket Ie | 2003 | — |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-2064?
How severe is CVE-2009-2064?
How do I fix CVE-2009-2064?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-2058Apple Safari before 3.2.2 uses the HTTP Host header to deter…
- CVE-2009-2059Opera, possibly before 9.25, uses the HTTP Host header to de…
- CVE-2009-2060src/net/http/http_transaction_winhttp.cc in Google Chrome be…
- CVE-2009-2061Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT r…
- CVE-2009-2062Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT respo…
- CVE-2009-2063Opera, possibly before 9.25, processes a 3xx HTTP CONNECT re…
- CVE-2009-2065Mozilla Firefox 3.0.10, and possibly other versions, detects…
- CVE-2009-2066Apple Safari detects http content in https web pages only wh…
- CVE-2009-2067Opera detects http content in https web pages only when the …
- CVE-2009-2068Google Chrome detects http content in https web pages only w…
- CVE-2009-2069Microsoft Internet Explorer before 8 displays a cached certi…
- CVE-2009-2070Opera displays a cached certificate for a (1) 4xx or (2) 5xx…
Are you affected by CVE-2009-2064?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST